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ABSTRACT 


In  this  paper,  we  examine  the  implied  faulty  sets  in  the  case  of  the  PMC 
system  level  fault  model.  We  show  that  those  sets  possess  a  maximal! ty  pro* 
perty  whenever,  the  system  is  one-step  r-diagnosable,  no  two  modules  test  each 
other  and  the  number  of  faulty  modules  is  no  larger  than  r.  In  addition,  we 
propose  a  syndrome-decoding  algorithm  based  on  that  maximality  property. 

* 


V' 

i 


i 


-3- 

TNTRODUCnON 

Since  its  introduction  in  1967,  the  PMC  system  level  fault  model  proposed 
byjPreparata,  Metro  and  Chienj[9]  has  been  the  subject  of  much  attention. 
Conditions  that  insure  one-step  r-diagnosability  have  been  proposed  in  [1],  [3] 
and  [9],  and  decoding  algorithms  have  been  proposed  in  [2]  and  in  [4M8]. 

One  of  the  major  stumbling  blocks  for  the  synthesis  of  decoding  algo¬ 
rithms  for  the  PMC  model  is  the  absence  of  known  useftri  properties  that 
result  from  the  assumptions  of  the  model.  Thus,  the  existing  algorithms 
depend  either  on  strong  assumptions  on  the  structure  of  the  testing  intercon¬ 
nection  151,  [7],  on  unproven  conjectures  [2],  or  on  searches  with  the  associ¬ 
ated  drawback  —  namely,  backtracking  [4]  -  or  they  are  insured  to  work  only 
when  few  faults  are  present  [6]  [81. 

It  seems  reasonable  to  assume  that  if  a  PMC  model  is  one-step  r- 
diagnosaUe,  then  well-chosen  quantities  exist  that  exhibit  useful  properties.  In 
previous  work  [5M8J,  we  used  the  concept  of  the  implied  faulty  set  to  analyze 
the  PMC  model.  The  implied  faulty  set  of  a  module  is  simply  the  set  of  all  the 
modules  in  the  system  that  may  be  deduced  to  be  faulty  under  the  assumption 
that  the  module  is  non  faulty.  The  usefulness  of  this  concept  has  been  demon¬ 
strated  in  [5]  and  [71  for  the  case  of  D^r  interconnection  structures,  and  in  [6] 
and  (81  for  the  case  in  which  no  two  modules  test  each  other,  and  the  number 
of  faulty  modules  is  small. 

In  this  paper,  we  show  that  the  implied  faulty  sets  of  one-step  r- 
diagnnaahie  PMC  models  in  which  no  two  modules  test  each  other  satisfy  a 
principle  qf  optimality:  the  module  that  corresponds  to  a  maximal  implied  faulty 
set  is  always  faulty. 
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THE  PMC  SYSTEM  LEVEL  FAULT  MODEL 

Consider  a  system  S  at  n  modules  Uq,  U  lf ... ,  Vn-i  and  a  testing  inter¬ 
connection  design  TID  -  {(/  J)  ( U,  tests  Uj  }.  It  is  assumed  that  when  0  J) 
is  in  77Z>,  the  test  outcome  atJ  of  U,  testing  Uj  is  a,  j  -  0  if  U,  believes  Uj  to 
be  nonfaulty,  and  a,  j  -  1  if  U,  believes  Uj  to  be  faulty.  A  complete  set  of 
test  La.*  an  outcome  a,j  for  each  (/  J)  in  TID  is  called  a  syndrome. 

The  diagnosis  problem  consists  in  partitioning  S  into  the  set  G$  of  non  faulty 
modules  and  the  set  Fs  of  faulty  modules  from  the  knowledge  of  one  of  the 
P»— ih»*  corresponding  syndromes.  In  this  paper,  we  assume  that  the  only 
faults  that  may  occur  are  solid,  and  that  the  test-fault  relationship  satisfies  at 
the  Preperata-Metze-Chien  assumption  given  below. 

Hypothesis  1: 

(0  If  (/ J)  is  in  TID  and  is  nonfaiity,  then  atJ  —  0  implies  that  Uj  is  nan- 
faulty,  and  a,  j  -  1  implies  that  Uj  is  faulty, 

(ii)  If  Uj)  is  in  TID  and  U,  is  faulty,  then  Uj  may  be  nonfaulty  or  faulty 
regardless  of  the  value  of  Ofj. 

Given  (GyU^),  Hypothesis  1  implies  that  only  a  subset  of  all  possible  syn¬ 
dromes  may  occur.  Determining  all  possible  syndromes  that  correspond  to  a 
given  partition  ( GSyFs )  of  S  is  not  difficult  On  the  other  hand,  the  problem 
we  address  in  this  paper  -  that  is,  given  a  syndrome  produced  by  a  partition 
(Gs/s)  of  S,  find  (GStFs)  -  is  much  more  difficult  to  solve. 

Not  all  the  partitions  of  S  into  nonfaulty  and  faulty  modules  may  explain  a 
given  syndrome.  A  partition  (G  JF)  of  5  is  consistent  with  a  given  syndrome  if 
and  only  if  the  assumption  that  all  the  modules  in  G  are  nonfaulty  and  all  the 
modules  in  F  are  faulty  is  consistent  with  the  syndrome.  The  partition  (GSfFs) 


j 


-5- 


a  obviously  consistent,  but  unfortunately,  many  partitions  usually  exist  that  are 
consistent  with  any  given  syndrome.  Thus,  gtan  a  syndrome,  one  cannot 
identify  the  faulty  modules  without  additional  assumptions. 

If  we  assume  that  the  a  priori  probability  that  a  set  of  modules/1  is  faulty 
is  inversely  proportional  to  the  cardinality  I/*  lof  F,  then  it  is  reasonable  to 
look  for  the  consistent  partitions  of  S  that  are  most  likely  to  occur,  namely,  the 
consistent  partitions  of  5  in  which  1/ 1  is  minimal  Such  partitions,  called 
minimal  consistent  partitions  are  the  solutions  to  the  following  discrete  minimiza¬ 
tion  problem. 

Problem  1:  Given  a  syndrome,  find  a  consistent  partition  (G#yF#)  of  5  such 
that  If#  I  <  1/ 1  for  all  the  partitions  (GJF)  of  S  that  are  consistent  with  the 
syndromei 

If  the  number  of  faulty  modules  does  not  exceed  r,  at  least  one  consistent 
partition,  namely  iGStFs),  exists  such  that  Ifj  I  <  r.  If  only  one  such  parti¬ 
tion  exists,  then  finding  the  partition  (.Gs^Fs)  reduces  to  solving  Problem  1 
whenever  Ifj  I  <  r.  Thus,  in  the  context  of  our  paper,  one-step  t- 
dfagnoeabftity  [9]  reduces  toe 

Definition  1:  A  system  5  is  ofie-step  r-diagnosabie  if  and  only  if  whenever  a 
consistent  partition  (G  *F)  exists  such  that  If  I  <  r,  that  partition  is  the 
unique  solution  to  Problem  1. 

IMPLIED  NON-FAULTY  AND  FAULTY  SETS 

We  have  raduoed  the  problem  of  identifying  the  partition  {GSVFS)  to  that 
or  solving  a  qscrmb  nunnnizauDn  proomn,  rronem  i.  uur  appeoeen  to  una 
problem  depends  on  the  conoepts  of  implied  non  faulty  and  faulty  seta. 


Definition  2:  The  implied  non  faulty  set  M(.U( )  of  a  module  U,  (with  respect  to 
a  given  syndrome)  is  the  set  of  ill  the  modules  inS  that  may  be  deduced  to  be 
non  faulty  under  the  assumption  that  £/,  is  non  faulty. 

Definition  3:  The  implied  faulty  set  LiU,)  of  a  module  U,  (with  respect  to  a 
given  syndrome)  is  the  set  of  all  the  modules  in  S  that  may  be  deduced  to  be 
faulty  under  the  assumption  that  £/,  is  non  faulty. 

If  the  module  U,  is  in  Gs ,  then  MiU,)  is  a  subset  of  G$,  LW})  is  a  sub¬ 
set  of  FSt  and  therefore,  MW-,)  and  LCUt)are  disjoint.  Thus,  if  AfCt/,)  and 
1,(1/,)  are  not  disjoint,  we  may  conclude  that  U,  is  in  Fs .  Let  Fq  and  G0  be 
the  sets  defined  by 

/•<>-{(/,  €  S  JA #«/,)  nitt/,)**}, 

and 

The  set  /0  is  a  subset  of  Fs,  provided  that  the  basic  assumption  on  the 
fault-test  relationship,  namely  Hypothesis  1,  holds.  The  fact  that  Fq  is  a  subset 
of  Fs  does  not  depend  on  any  assumption  concerning  the  maximum  number  of 
faulty  modules,  nor  on  assumptions  concerning  the  structure  of  the  testing 
interconnection  network.  The  set  F0  is  not  difficult  to  obtain.  Given  a  system 
S  and  a  syndrome,  we  may  compute  F0  and  consider  the  reduced  system  S0 
obtained  by  deleting  F0  from  S  and  the  corresponding  reduced  syndrome 
obtained  by  deleting  all  the  tests  links  between  G0  and  FQ  from  the  original 
syndrome.  Note  that  if  5  is  one-step  r-diagnosable,  then  50  is 
ooe-step  (r-l/ob-diagftowahlc. 

dearly,  if  Hypothesis  1  is  satisfied  and  if  !(£/,)  n  G0  —  4  far  every 
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module  U,  in  Gq,  then  the  partition  (G^q)  is  &  solution  to  Problem  1.  Thus* 
Definition  1  implies  that,  in  some  cases,  the  set  F$  of  faulty  modules  is  the  set 
** 

Lemma  1:  If  Hypothesis  1  is  satisfied,  if  S  is  one-step  r-diagnosabie,  if 
LiU,)  n  G0  -  ♦  for  every  module  U ,  in  Go»  and  if  l/pl  <  r,  then/s  “ 
F* 

MAXIMALITY  OF  THE  IMPLIED  FAULTY  SETS 

The  set  Fq  may  be  computed  as  soon  as  the  implied  non  faulty  and  faulty 
sets  have  been  obtained,  and  we  know  that  every  module  in  F0  is  faulty.  We 
have  no  reason  to  believe  that  Fq  contains  all  the  faulty  modules.  We  could 
use  the  fact  [8]  that  F  ™  L(G ),  where 

I(G)-{£/y  |  Uj  €  LiU,\  U,SG) 

whenever  iGJP)  is  a  minimal  consistent  partition,  to  search  for  the  minimal 
consistent  partitions,  but  this  search  may  be  tedious.  We  will  now  present  a 
property  of  the  implied  faulty  sets  that  holds  when  the  Hakimi-Amin  [3] 
sufficient  conditions  for  one-step  r-diagnosability  are  satisfied. 

Hypothesis  2  ( Hakimi-Amin ): 

(0  every  module  is  tested  by  at  least  r  other  modules; 

00  no  two  modules  test  each  other. 

We  know  from  [3]  that  Problem  1  possesses  a  unique  solution  whenever 
Hypotheses  1  and  2  are  satisfied  and  the  number  of  faulty  modules  is  not 
greater  than  r.  In  such  s  case,  the  implied  faulty  sets  possess  s  property  that 
greatly  simplifies  the  task  of  decoding  syndromes. 

Theorem  1:  If  Hypotheses  1  and  2  are  satisfied,  and  if  l  <  Ifj  I  <  r,  then  at 
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least  one  module  U,  in  S  exists  such  that  either  MW, )  n  1(1/,)  ^  4,  or 
IZ.CC/y )  I  >  r+1,  or  both. 

Proof1.  See  Appendix. 

We  may  use  Theorem  1  to  exhibit  a  maximality  property  of  the  implied 
faulty  seta.  If  Fs  is  non-empty  and  if  F0  is  empty,  then  at  least  one  module  U, 
exists  so  that  \LW,)\  >  r  +1;  thus,  the  modules  Uj  inS  that  maximim 
IZ.CC/y )  I  are  faulty. 

Corollary  1:  If  Hypotheses  1  and  2  are  satisfied,  if  1  <  l/$  I  <  r  and  if  3/(1/,) 
n  L(l/,)  —  ^  for  every  module  in  5,  then  the  modules  Uj  that  maximize 
lz«/y)l  are  in/g. 

Corollary  1  may  be  used  recursively  to  generate  the  set/5  of  faulty 
modules  in  S,  and  thus,  when  Hypotheses  1  and  2  are  satisfied,  an  iterative 
"greedy-type"  algorithm  wfll  produce  the  se:  of  faulty  modules,  provided  that 
the  set  /0  is  first  identified. 

Algorithm  1: 

Step  0:  Let/o  -  {  U,  €  S  J  MW,)  n  LW,)  *  *},  and  let  *  -  0. 

Step  1:  Let  A*  "  max  {  I  LW,)  H  (5 -f*)l  |  U,  €  S -Fk  }. 

Step  2:  If  hk  “  0,  let  FA  —  Fk  and  stop;  otherwise,  go  to  Step  3. 

Step  3:  Let Hk-[U,  €  S-Z*  |  \LW,)  n  (5 -Z*)l  - 
Step  4:  Let  Fk+\  mmFk  U  Hk. 

Step  S:  Let  A:  —  fc+1,  and  go  to  Step  1. 

The  fact  that  S  contains  a  finite  number  of  modules  implies  that  Algorithm 
1  terminates  after  a  finite  number  of  iterations.  Using  Lemma  1,  Theorem  1 
and  Corollary  1,  we  may  then  obtain  the  following  result. 


Theorem  2:  If  Hypotheses  1  and  2  axe  satisfied,  and  if  l/j  I  <  r,  the  aotFA 
generated  by  Algorithm  1  is  equal  to  the  set  of  faulty  modules  Fs. 

APPENDIX:  Proof  of  Theorem  1 

Our  proof  of  Theorem  1  is  similar  to  the  one  used  by  Haldmi  and  Amin  in 
[3].  First,  we  assume  that  the  result  of  the  theorem  does  not  hold;  we  then 
partition  the  system  S  and  using  that  partition,  we  exhibit  two  inequalities 
which  taken  together,  lead  to  a  contradiction.  Thus,  in  this  appendix  we  shall 
assume  that  we  have  a  PMC  system  level  model  in  which: 

( Al)  every  module  is  tested  by  at  least  r  other  modules, 

(A2)  no  two  modules  test  each  other, 

(A3)  the  number  of  faulty  modules  lfs  I  satisfies  1  <  lfs  I  <  r, 

(M)  MWl )  H  £(£/,)  —  4  for  every  module  U,  in  S,  and 
(A5)  lL(P,)l  <  r  for  every  module  (/,  in  S. 

Lett/,  be  a  faulty  module  in  S  such  that  for  every  faulty  module  U,  in  5, 

iMWJ  ClFs  I  >  I^Wf)  n  Fs  I.  (1) 

We  now  partition  our  system  5  into  five  subsets:  K,,  V2>  V},  V4  and  Vy 

Let  Kj  —  MWm)  H  Fs.  Thus,  K]  consists  of  all  the  modules  inFs  that 
must  be  nonfaulty  if  Um  is  assumed  to  be  nonfaulty  and  Um  is  in  Vx. 

Let  V2  be  the  subset  of  S  that  consists  of  all  the  modules  in  £((/»)  that 
are  actually  faulty,  Le., 

V2-UUjnFs. 

Let  K  3  be  the  set  of  all  faulty  modules  that  axe  not  In  Kj  or  K*  le., 
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Let  K  4  be  the  subset  of  5  that  consists  of  ail  the  modules  in  the  implied 
faulty  set  of  U « that  are  actually  nonfatdty,  Le., 

Let  V  j  be  the  set  of  ail  nonfaulty  modules  that  are  not  in  £(£/•),  Le., 

Vs-Gs-V* 

Qeariy,  the  sets  Kj,  V2  and  V3  form  a  partition  for  Fs,  and  the  sets  V A 
and  Kj  form  a  partition  for  Gs. 

For  i  -»  1,  2,  3,  4,  5  and  7  1,  2,  3,  4,  5,  let  £,  ^  be  the  ret  of  testing 

links  from  K,  into  Ky,  let  v(  denote  the  cardinality  of  the  partition  block  V, ,  let 
ejj  denote  the  cardinality  of  the  ret  of  0-links  from  K,  to  Vj ,  let  e^j  denote  the 
cardinality  of  the  rets  of  1 -links  from  Vj  to  Vj,  and  let  e,j  —  eft  +  Lei, 
is  the  cardinality  of  the  ret  of  testing  links  Ejj. 

The  definition  of  the  partition  blocks  V,  implies  that  the  number  and  type 
of  testing  links  between  blocks  may  not  be  arbitrary. 

Lemma  2:  The  testing  links  rets  S/J  satisfy: 

(0  —  *5,1  —  *5,4  —  $ 

(ii)  £j,i,  £1,5,  £3,1,  £4,4,  £4,5  and  £5,5  consists  only  of  0-links; 

(ill)  £j,j,  £i>  £ 34*  £ 3,4*  £4,1*  £4^5  £4^  £5,2  Mid  £5,3  consist  only  of  1 -links; 
(hr)  £3,1,  £2,2*  £24*  £2,4*  £2, 5’  £3,3  and  £3,5  consist  of  both  0-links  and  1- 
links. 

Proof!  Let  U,  be  in  Kj,  and  let  Uj  be  in«S.  If  a  0-link  from  Ut  to  Uj  exists, 
then  Uj  must  be  in  V2  U  Ks,  and  if  there  is  a  1-link  from  Cf,  to  then  Uj 
must  be  in  L(U *)  and  hence,  in  V2  U  V+  We  may  then  conclude  that  £u 
and  £14  consist  of  only  0-links,  that  £14  and  £1,4  consist  of  only  1 -links,  and 


-11  - 


thateu  —  0. 

Let  U,  be  in  K 3,  and  let  Uj  be  in  5.  If  a  0-link  from  to  U}  exists,  then  Uj 
must  beinKiU^UK^if  there  is  a  1-link  from  £/,  to  UJt  then  Uj  must  be 
in  K2  U  V3  U  V4  U  Vy  We  may  then  conclude  that^i  consists  of  only  0- 
links,  and  that  £3t2  £3,4  consist  of  only  1-links. 

Let  Uj  be  in  K 4,  and  let  Uj  be  in  S.  By  construction,  U,  is  non  faulty  and  Uj 
is  faulty  whenever  Uj  is  in  l'  1  u  V2  U  V$Uj  is  non  faulty  whenever  (Jj  is  in 
K4UK5.  We  may  then  conclude  that  £41,  2  and  £43  consist  of  only  1- 

links,  and  that  £4,4  and  £^s  consist  of  only  0-links. 

We  cannot  have  any  testing  links  from  Ks  to  K  j  or  K4,  because  whenever  a 
non  faulty  module  tests  a  module  in  either  V\  or  V4t  it  must  be  in  L(t/*), 

9 

thus  —  «s.4  “  0-  By  construction,  a  module  U,  in  K5  is  non  faulty  and 
thus,  £3^  and  £$,3  consist  of  only  1-links,  and  £5,5  consists  of  only  0-links.  □ 
Every  module  is  tested  by  at  least  r  other  modules,  and  therefore, 

*1,1  +  *2,1  +  *3,i  +  *4,i  >  r»i.  (2) 

and 


*1,4  +  *2,4  +  *3,4  +  *4,4  >  tv4* 


(3) 


No  two  modules  test  each  other,  and  thus 


*1,1  <  Vjfvj— l)/2. 

(4) 

*4,4  <  V4(v4-1)/2, 

(5) 

*1,4 +  *4,1  <  VlV* 

(6) 

*2,4  <  v2V4. 


(7) 
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The  fact  that  lL(C/;)l  <  r  for  every  module  U,  in  S  implies  that  the  number 
of  1-links  from  a  partition  block  K,  to  S  cannot  be  larger  than  the  number  of 
(Minks  from  S  to  Vt ,  and  therefore, 

*ii  +  *£2  +*£3  +e{*  <  e£a>  (*) 

and 

«3,4<*£3  +«?,3-  (9) 

The  maximal ity  of  the  module  U  *  on  which  the  basic  partition  is  based  implies 
that  no  faulty  module  may  find  more  than  vj— 1  faulty  modules  non  faulty,  and 
thus, 

e£i  +*£2  +  *£3  <  v2(vi— 1),  (10) 


and 


*3,1  +  *£,3  <  V3(Vj-l). 
Equations  (2)  and  (4)  imply 


*4,1  >  rv!  -  v,(v,-l)/2  -  eu  -  e3<1. 
Equations  (3),  (5)  and  (7)  imply 


>rv 4  -  v2v4  -  eit4  -  v4(v4-1)/2. 


Thus,  using  (6),  we  obtain 

X  +  Y  >0 


(ID 


(12) 

(13) 

(14) 


where 


X  —  Vjv4  —  rvj  +  Vj(vj— 1)/2  —  rv4  +  V4CV4 — 1)/2  +  v2v4,  (15) 


and 


y  “  *2,1  +  *3,1  +  *3,4-  (16) 


-v- k/r1" 
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Using  (9),  we  obtain 

r  <«a,i+ «3,i +«&+«?>  «w 

and  using  (11),  we  find  that 

Y  <  «2,i  +  *£3  +  vjCvj— 1).  (18) 

Inequalities  (8)  and  (10)  yield 

eii  +  *£2  +*£3  +*2.4  +  *£1  +*£2  +*£3  <  *£2  +V2^vr“j)»  09) 

thus 

*£1  +  *2,1  +*£3  <  v2(vj— l),  (20) 

and  we  may  conclude  that 

*2,1  +*£3  <  v2(v,-l).  (21) 

Using  (18)  and  (21),  we  obtain 

Y  ^  v^vj—l)  +  v2(vj— 1).  (22) 

The  number  of  faulty  modules  is  at  most  r,  Le., 

vj  +  v2  +  v3  <  r,  (23) 


and  thus 

vi(vr”l)/2  +  w2(v2 — 1)  +  V3(vj— 1)  <  r(vi— 1)  —  *j(»r- 1)/2.  (24) 

The  feet  that  lL(C/f)l  <  r  for  every  module  U,  in  S  implies  that  v2  +  v4  < 
r,  and  thus 

v2  <  r  —  v4.  (25) 

Using  (14),  (15),  (16),  (22),  (24)  and  (25),  we  obtain 

vl*4  “  tvj  +  t(vj— 1)  —  w1(v1 — 1  )/2  —  rv4  +  v4(v*-D/2  +  (r-v^^  >  0.(26) 


Equation  (26)  may  be  rewritten  as 


(»!  —  V4>/2  —  (vj  -  v 4)^/2  --  r  >  0.  (27) 

It  is  easy  to  verify  that 

<vi  -  V4>/2  -  (vj  -  v 4)^/2  <  0.125  (28) 

for  all  values  of  vj  and  V4,  and  thus 

0.125- r>0.  (29) 

Equation  (29)  implies  that  r  must  be  equal  to  0,  and  this  contradicts  (A3). 

We  have  shown  that  the  five  basic  assumptions  given  at  the  beginning  of 
the  appendix  lead  to  a  contradiction  and  thus  may  not  hold.  We  can  therefore 
conclude  that  if  a  PMC  model  satisfies  (Al),  ( A2)  and  (A3),  then  (A4)  and 
(A5)  may  not  hold  simultaneously;  that  is,  if  (Al),  (A2)  and  (A3)  hold,  then 
at  least  one  module  U,  in  S  exists  so  that  either  (0  MiU, )  n  L(U, )  0,  or 

(ii)  l£(Cf,)l  >  r  + 1,  or  both. 
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